thank you, J%l@gJR!0Tv7p^IcPRh4 good boy

Standing at the door and making sounds like a dial-up modem to get your dog back inside.

Don't use your dog's name as a password. Don't use "security questions", they are highly insecure disaster waiting to happen.

Then can I have the name of your dog and your mother's maiden name for my password?

Do use security questions, but with wrong answers (stored in a password manager).

For example, one of my bank security questions is the name of my paternal grandmother, but I used my grandfather's name instead.

Edit: Also, if the account requires a password recovery passphrase, keep in mind that you might need to tell customer support it. The agent for my gas provider got a good chuckle out of ours being "mmmcrack"

Now we know...

The town where you were born... Vauxhall Nova

I used to just have a standard complex sentence memorized as my security question reply. No matter what question is asked, I type the properly formatted sentence, with capitalizations and punctuations in all the right places.

The question itself is useless for anyone who is trying to data mine me for access. If they don't know the sentence I use, and exactly how it's formatted, then they'll never get in. I would usually just pick random questions because it doesn't really matter.

Bonus: Most people don't use proper punctuation, spelling, and/or capitalization online anymore. So even if they learn the sentence, figuring out how to format it correctly will pose a challenge. Unless they're an English teacher (or a bibliophile).

Yeah I try to have a not real answer for those security questions

but with wrong answers (stored in a password manager)

In which case you never need to reset a password to begin with.

I just use additional passwords as recovery answers.

Username: tiddysprinkles

Password: fhg@t2Gxs7...

What street did you grow up on: D$pvEb4...

What was your first pets name: xwDu#&8w...

Like, okay, so an adversary wants to crack into my account. They're going to need the unique email addresses for that account, my 60+ character passwords (100+ when allowed), my TOTP... Or the email, and three 60+ passwords...

At some point I'll need to call up cs for something and answer D$pvEb4... as the street I grew up on. But it's been a decade+ without a problem...

You know what kills me? My Steam account is secured by a constantly rotating temporary key on a phone app. My bank uses security questions.

Just let the war happen.

I mean, it makes sense. I care about the games worth hundreds more than the $free.fifty in my bank lol.

https://youtu.be/GRx0_HPNKII

Do use security questions, but with wrong answers (stored in a password manager).

what would be the point of that? if you know how to and use password manager, then you already have good password you are not going to forget. what would be the point of having secondary password stored in the same database?

one of my bank security questions

i had a client who was getting divorce, because "security question" to his email account was name of the parrot he shared with his wife. they were both in their 70s...

"security question" is the most stupid concept in security. here, in case you forget your password, lets just setup another password, and let it be something so trivial that 10 people already know it and another 100 can easily google or find it on your facebook.

whoever came up with it should be shot together with creator of comic sans. if a BANK demands you to setup one, you should run as far as you can from their service.

We just have a specific set of answers to the security questions. They don't match the question.

I agree. We used my cats instead of people's names. Like the whole extended family did I have the best cats

Theoretically, yeah, but practically you still probably should change a password after a database breach

My bank has us set up a verbal password to have the tellers do shit for us over the phone. They have a note in mine that if I only say the password and don't sing it it's incorrect. I change the lyrics/password like once a year.

Guys... No. Are you kidding me? NO.

The AI's are just going to level 99% of people, man.

Would be great if steam finally supported regular otp. There are ways to extract the key from the app, but then you need an authenticator that can deal with steams nom standard 5 character (i think) codes.

I've told my friend to stop using her kid's name and birthday digits for all her passwords. She doesn't care.

Omg I used a random password as a security question once and I had to recite it over the phone 😭